Suggestions on process integrity checking
in [Kernel]
|
Prev: Add documentation for trace commands mod, traceon/traceoff
Next: security: testing the wrong variable in create_by_name()
From: Jose Luis Marchetti on 23 Apr 2010 13:00 Hi, I need to implement a process integrity check, this is to make sure that a process that is running at the time of checking was not corrupted since it was first loaded in memory. I would appreciate suggestions on where I should implement this in the Linux kernel, my first outline of this work is: 1) Add a field to task_struct that would hold some sort of process digital signature, it could be a CRC32 of process code space, this is not defined yet. 2) For simplicity let us assume an elf file is being executed, in binfmt_elf.c I see the elf file program segments are mmap to the virtual addresses and no read is actually done there ( or am I wrong ?). Where the reading of program segments is actually being done. 3) When the program segments are read in memory I need to update the process digital signature. 4) Then there is the checking part, if the kernel have to perform this checking periodically, how/where do you suggest it to be implemented ? I was not successful in finding any similar implementation on the Internet that I could base my work on, if you know of any, please let me know. Thanks in advance for any suggestion. Jos� Lu�s Marchetti -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |